ClawHub
Back to skill

Security audit

azure-devops

Security checks for vulnerabilities and agentic risk

Overview

This Azure DevOps skill is purpose-aligned and disclosed, though users should be aware it can create PRs and store organization/project settings when asked.

Install only if you want Codex to operate against your Azure DevOps environment. Review `.claude/azure-devops.json` before use, prefer repo-local config over home-directory fallback for different tenants or projects, and confirm PR creation, reviewer changes, auto-complete, and branch pushes before allowing them.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The skill advertises very broad trigger phrases such as generic mentions of 'azure devops', 'az boards', and 'what's assigned to me', and even says to invoke the skill when those phrases appear without explicit skill selection. That can cause unintended activation in ordinary conversation, which is risky because this skill can read work items, attachments, local config, and guide PR creation workflows against a live Azure DevOps environment.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: azure-devops
description: Work with an Azure DevOps org via the az CLI — query sprint/assigned work items with WIQL, read a work item's description AND download+view its embedded screenshots, publish branches, and create PRs with configured house defaults (required reviewers, auto-complete, work item linked, one PR per repo). Reads org/project/reviewer settings from `.claude/azure-devops.json` and offers to create it on first use. Use this skill whenever the user says "pull my tasks", "my sprint work items", "what's assigned to me", "read task 12345", "read the work item", "get the screenshots from the work item", "link the PR to the work item", "set auto-complete", or mentions "azure devops", "az boards", "az repos" — even if they don't explicitly say "azure-devops skill". For "create a PR" defer to the create-pr skill (this skill is its Azure DevOps backend and supplies the PR mechanics). Do not use for GitHub repos (use gh) or for local git-only operations.
---

# Azure DevOps
Confidence
75% confidence
Finding
The skill reads and offers to persist organization, project, reviewer identities, and tool path information in `.claude/azure-devops.json` or a home-directory fallback, creating session persistence across runs. While not inherently malicious, persistent storage of operational context and identity metadata increases the chance of unintended reuse across repositories, disclosure of internal organization details, or acting on the wrong Azure DevOps tenant/project if the context is stale or mis-scoped.

Static analysis

No suspicious patterns detected.